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This paper reports the latest development of several techniques for adaptive flight 
envelope estimation and protection system for aircraft under damage upset conditions. 
Through the integration of advanced fault detection algorithms, real-time system 
identification of the damage/faulted aircraft and flight envelop estimation, real-time decision 
support can be executed autonomously for improving damage tolerance and flight 
recoverability. Particularly, a bank of adaptive nonlinear fault detection and isolation 
estimators were developed for flight control actuator faults; a real-time system identification 
method was developed for assessing the dynamics and performance limitation of impaired 
aircraft; online learning neural networks were used to approximate selected aircraft 
dynamics which were then inverted to estimate command margins. As off-line training of 
network weights is not required, the method has the advantage of adapting to varying flight 
conditions and different vehicle configurations. The key benefit of the envelope estimation 
and protection system is that it allows the aircraft to fly close to its limit boundary by 
constantly updating the controller command limits during flight. The developed techniques 
were demonstrated on NASA’s Generic Transport Model (GTM) simulation environments 
with simulated actuator faults. Simulation results and remarks on future work are 
presented. 


I. Introduction 

S ignificant research has been conducted in recent years on the development and implementation of the Integrated 
Resilient Aircraft Control (IRAC) technologies for both civil and military aircraft. To improve post-failure flight 
safety, it is highly desirable to characterize the adverse conditions (faults, damage, and/or upset), and estimate the 
achievable flight envelope of the aircraft. With the term aerodynamic envelope we refer to the set of states in which 
control actions exist to ensure that the vehicle can proceed to a safe landing from the air, while constraints on flight 
path, landing point and velocity are satisfied. The different types of anomalies including failed actuators, failed 
engine, and damaged surfaces may result in the changes of the aerodynamics coefficients, therefore the real-time 
estimation of system health, especially the identification of the aerodynamic coefficients and the extrapolation of the 
identified system dynamics are key steps for modeling the damaged aircraft. 

To address this challenging problem, a variety of techniques have been developed in the past few years by 
researchers from the industry, academia and government. Particularly, researchers at NASA have conducted studies 
on the aerodynamic effects and modeling of damage to transport aircraft 1 , general equation of motion for damaged 
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asymmetric aircraft 2 , and flight dynamics to account for changes in aerodynamics, mass properties, and the center of 
gravity that can compromise the stability of the damaged aircraft 3 . A recent simulation study was also conducted to 
investigate aerodynamic modeling methods for prediction of post-stall flight dynamics of large transport airplanes 4 . 
Evaluation of flight envelope has been tackled with various offline and online methods. Offline methods include 
wind tunnel testing and high-fidelity model-based computation of attainable equilibrium sets 5 . Online methods 
include formulating flight envelope estimation as a reachability problem and solved with level set method 6,7 , and 
Boeing’s approach using Control-Centric Modeling, dynamic flexible structure and load models 8 . Formal robustness 
analysis method has also been used for determining a reliable flight regime in the flight envelope within which an 
integrated resilient control system can achieve the desired performance in the presence of parameter uncertainty and 
unmodeled dynamics 9 . 

In conjunction with fault tolerant control aspect, Lombaerts et al developed a nonlinear reconfigurable flight 
control based on online physical model identification, where the damaged aircraft model is identified and applied in 
real time to the model-based adaptive nonlinear dynamic inversion routine which allows flight control 
reconfigurations online 10 . A coauthor of this paper has conducted automatic flight envelope protection technology 
for autonomous unmanned aerial vehicles where online-learning adaptive neural networks are utilized to generate 
online dynamic models, which are used to estimate limits on controller commands 11 . In conjunction with adaptive 
trajectory generation and path planning, Tang et al developed an adaptive flight planner to build landing trajectories 
for disabled aircraft 12 . A case study was investigated in which a Generalized Transport Model aircraft must land 
following the loss of a significant fraction of its left wing. In their work, post-damage flight envelope was defined by 
a set of trimmed flight conditions. 

This paper reports the latest development of several novel techniques for adaptive flight envelope estimation and 
protection. Through the integration of advanced fault detection algorithms, real-time system identification and flight 
envelop estimation, real-time decision support can be executed autonomously to improve damage tolerance and 
flight recoverability. Our approach is different from others in many aspects. First, we investigated not only the 
online system identification of the changes of aerodynamic coefficients, but also the extrapolation/prediction of 
these changes to other operating conditions. Secondly, we use separated approaches for flight control actuator faults 
and airframe faults so that the higher technological readiness level (TRL) solutions for actuators faults can be 
utilized in addition to the general system ID approach. Last but not lease, we highlight the seamless integration of 
online flight envelope estimation and protection functions as a total solution. 

The novelty in this approach is the integration of online system identification (ID), parameter extrapolation and 
efficient reachable set calculation to estimate and protect the achievable flight envelope after the occurrence of 
faults. The highlights of the innovation are illustrated in Figure 1 and listed as follows: 

• Changes of aerodynamic coefficients are 
identified by a recursive system ID 
technique using onboard sensor 
measurements; 

• Predicting the flight envelope at a 
different flight condition based on the 
estimation at current and past conditions 
is addressed by an computationally 
efficient linear extrapolation method; 

• The flight envelope estimation is 
continuously updated and improved as 
more flight conditions are visited; 

• The computation of the aerodynamic 
envelope is formulated as a reachability 
problem and solved efficiently using the 
level set methods. 

• For envelope protection, online learning neural networks are used to approximate selected aircraft 
dynamics which are then inverted to estimate command margins for limit avoidance. 

The purpose of this paper is to provide a brief overview of several methodologies recently developed by the 
coauthors in a NASA sponsored program. The rest of this paper is organized as follows. Section II gives an 
overview of the developed system architecture. Section III through Section VI presents a few select methodologies 


Figure 1. Online System Identification, Parameter 
Extrapolation & Progressive Envelope Estimation 



1 . Nonlinear ID of changes of aero-coefs 

2. Linear extrapolation 


3. Estimate immediate envelope 

4. Assume an approximate flight envelope 
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that address the key functionalities of the system. Simulation results are presented in Section VII. The last section 
concludes the paper with remarks on future research directions. 

II. System Overview 
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Figure 2. EEP System Architecture 


The system architecture for the onboard flight envelope estimation and protection (EEP) system is shown in 
Figure 2. Sensor measurement signals and state estimates from a state estimator (usually a Kalman or extended 
Kalman filter) are sent to an anomaly detection module. If the fault is classified as flight control actuator fault, 
diagnostic routines that are more appropriate for the problem 13,14,15 will be utilized to isolate the fault and estimate 
the fault parameters (e.g. control effectiveness loss, stuck position, etc.). In the case of airframe fault, the system 
ID/extrapolation approach is utilized to identify the 
changes of system aerodynamic coefficients. The 
identified fault parameters will be applied to update 
onboard aircraft model based on which the flight 
envelope can be estimated. The flight envelope 
concept consists of an immediate flight envelope 
that is used by real-time envelope protection and 
adaptive flight control, and an extended flight 
envelope that is used by the Adaptive Trajectory 
Generator. To reduce the computational burden 
onboard the aircraft, the flight envelope for known 
fault scenarios (especially for actuator faults) can be 
evaluated offline. Therefore, a flight envelope 
database that was created offline can than be 
utilized by the online EEP system for envelope 
estimation via interpolation provided that the fault 
condition can be estimated accurately in real-time. 

The extended flight envelope refers to the conventional flight envelope which is defined as a range of airspeed, 
attitude and normal load factor within which the aircraft can operate safely. Onboard estimation of the conventional 
flight envelope might not be practical in real-time since it concerns structure integrity. The assessment of the 
conventional flight envelope usually requires wind tunnel and structure integrity tests. Therefore its assessment can 
not possibly be done using only aerodynamic models. The immediate envelope refers to an achievable state 
envelope that the aircraft can reach given bounded-energy and bounded-magnitude inputs within a finite time 
horizon in the presents of flight anomalies. It can be estimated onboard using aerodynamic models. The immediately 
envelope estimation problem is closely related to envelope protection problem, while the conventional flight 
envelope will be useful for higher level functional modules such as trajectory generation and path planning. 

Several fault modes are considered in this study: 1). control surface fault and failure including loss of 
effectiveness and stuck actuator. In this case, the aerodynamic derivatives will change according to the type of 
control-surface failure. As shown in Figure 2, an actuator fault will be detected by the anomaly detector and isolated 
by the actuator diagnostic module using a bank of nonlinear fault isolation estimators. The estimated fault 
parameters (control effectiveness coefficients, stuck position, etc) will be used to update online aircraft model. 2) 
propulsion fault and failure including effectiveness loss or total loss of thrust; propulsion system fault can usually be 
treated as an actuator fault at the flight controls level. 3) airframe/structural fault; the aerodynamics of an aircraft 
changes when some of its parts are lost. For example, if the aircraft loses part of or the entire vertical fin, the 
directional stability, spiral performance, and rudder effectiveness will worsen. As shown in Figure 2, system ID 
based approach will be utilized for airframe fault. Sensor faults are not considered in the current study. Several 
enabling technologies are presented in the following sections. 

III. Nonlinear Adaptive Fault Detection and Isolation Estimators (FDIE) for Actuator Faults 

An actuator fault model can be represented by additive and/or multiplicative faults as follows: 


U f j =0{Uj+U jO 


( 1 ) 


3 

American Institute of Aeronautics and Astronautics 











where u j and u~. represent the j-th normal and faulty control actions. u j0 denotes a constant offset when the 
respective actuator is jammed and/or 0 < 6 J k <1 denotes a gain degradation (control effectiveness) of the j-th 
component. The 61 and/or u j0 parameters are estimated in real-time by the actuator FDIE module. The parameter 

estimates will be used to update the online aircraft model (GTM), which will be utilized to update flight envelope 
estimation. 

A. Online Actuator Fault Isolation and Estimation 

Consider a generic nonlinear aircraft model described by: 

X = Ax + y(x . , u) + ?j(x . , u 9 i)+/S(t- T f )(!>{x, u) 

\A) 

y = Cx + d(x,U,t) 

where jc,m, and y are the state vector, input vector, and output vector of the engine system, (A,C) is an observable 
matrix pair. The equation 


x N = Ax N +y{x N ,u) 
y N = Cx„ 

represents the known nominal nonlinear aircraft dynamics derived based on engine dynamics, while the healthy 
system is described by 


x H =Ax H +y(x H 9 u)+rj(x H 9 u 9 t) 

y H — Cx H ^4) 

The difference between the nominal model and the actual (healthy) system is due to the term 77 and d, which 
represent the modeling uncertainties in the state and output equations. The changes in the system dynamics as a 
result of an actuator fault are characterized by <fi(x ,u ) . 

Based on the system model, the following Fault Detection Estimator (FDE) is chosen: 

*° = Ax° + £&-?) + Y(y>»)> *°( 0 ) = 0 
y° = Cx° 

where x° and j>° denote the state and output vectors estimated from this FDE respectively, and L is a design gain 

matrix. Note that for an aircraft using full state feedback control, C is usually an identity matrix, therefore the term y 
is used in the y function. A fault is detected when at least one component of the modulus of the output estimation 

error s y {t) exceeds its corresponding threshold s y (t ) . 

The bank of fault isolation estimators (FIEs) is activated only after a fault is detected for the purpose of fault 
isolation. Each FIE is designed based on the functional structure of a particular actuator fault. Let us denote y s (t ) 
as the estimated output vector generated by the s -th FIE, where se { 1, •**,/} . Adaptive thresholds for each FIE are 
designed in such a way that in the presence of a fault in the s -th actuator, the residuals generated by all FIEs may 
exceed their corresponding thresholds, except for the s -th FIE. Note that the adaptive thresholds are functions of 
states and inputs and threshold values change when the operating condition changes, thus eliminating the need of 
model linearization and blending as many other methods do 15 . Proof-of-concept studies for this method have been 
conducted on the GTM model and simulation results are shown in Section VII. 

IV. Online System Identification and Progressive Model Updating 

An important consideration with online system ID-based approaches is that they typically only identify the system 
dynamics in the vicinity of the operating condition where identification takes place. Before the unknown full flight 
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envelope has been visited (which might not be recommended for an impaired aircraft), the available system 
performance limit won’t be completely known. Therefore, the flight envelope estimation process will have to be 
conducted as a progressive process in which the envelope estimation accuracy will be continuously improved as 
more operating conditions are visited safely. 

A. Online System Identification 

An accurate aerodynamic model estimate is required for determination of flight envelop estimation. Aerodynamic 
models are readily available for aircraft resulting from wind-tunnel analysis and can be updated to accurately 
describe aircraft motions offline. However, when failures are introduced such as damaged surfaces, wings, fuselage, 
etc existing aerodynamic models would not truly represent aircraft responses. Therefore, the aerodynamic models 
should be updated in real-time reflecting the failures based on aircraft measurement sensor information. We use a 
strategy where the existing aircraft wind tunnel model is used and updates to the existing model are identified. The 
nominal aerodynamic model is not disregarded but used as a basis for the updated model aiding the estimation 
process to converge on an accurate aerodynamic model more quickly and more precisely. As example of the 
methodology, consider the following aerodynamic model for coefficient of drag: 

C D = C Dt (a 9 h 9 m 9 q 9 d 9 8e 9 ..^-\- AC d ^ + AC d AF + A C d Aa + AC d Aa 2 

+A C Dge \ASe\ + AC D ^ASe 2 +-^{AC D Aq + AC D M^ ^ 

Where C^ (a,h,m 9 q 9 a 9 Se 9 ...) is the nominal aerodynamic model obtained from wind tunnel testing (usually a 

nonlinear table lookup model) and the terms following the AC symbol represent increments to the nominal model 
and are to be identified in real-time based on sensor information. The coefficient of drag can be estimated from 
sensor measurement using the following: 


-qsC n cos a + qsC T sin a + T y 
n =— — — — +/i 

2 m * 


(7) 


Where n x is obtained from an accelerometer sensor, n is determined by the sensor consistency models, T x is the 
thrust estimate. If the angle-of-attack is small then Eq. (7) is approximated by: 


-qsC D + T x 


+ n 


m 


( 8 ) 


Therefore, Eq. (6) may be written as: 


J = ~ n x b ~\~“C Dr (a 9 h 9 m 9 q 9 a 9 Se 9 ...y 


qs 


A C Dq + ACj^AV + A C Da A a + A C D 2 Aa 2 


Al 


A C D " \ASe\ + AC D ^ASe 2 +-^{AC D Aq + AC d M}\ 


(9) 


A linear regression method now be used to estimate AC terms using Eq. (9) updating the aerodynamic model. The 
linear regression routine minimizes Eq. (9). The proposed method has several advantages: 

1 . A simplified linear regression scheme can be used to estimate the model increments in real-time 

2. No numerical integration of dynamical equations are required 

3. The nominal aerodynamic model is utilized as a starting point and basis for the updated model 

4. The identified increments are non-dimensional and are used for estimating the flight envelope at other flight 

conditions. 

A similar approach can be developed for estimating lift, side force, and moment coefficients. Preliminary 
simulation has been conducted on the GTM model using a regularized recursive least square algorithm 16 . 
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B. Progressive Aerodynamic Model Updating 

The difficulty with flight envelope determination is in estimation of an accurate valid aerodynamic model given 
limited measurement data encompassing all flight condition of interest. Updating an aerodynamic model in the 
presence of a failure at a given flight condition (e.g. for cruising, referred to as Condition 1) with given flight 
measurement data at the current flight condition can be performed in real-time as discussed in previous sections. 
However predicting the flight envelop at a different flight condition say for a landing approach (referred to as 
Condition 2) based on the update at Condition 1 with no measurement data currently available for Condition 2 is 
another difficult problem. This prediction is essentially a constrained extrapolation problem. Without getting into 
mathematically complication, we will illustrate the approach with a simple linear extrapolation using the pitching 
coefficient ( Cm ). 

Consider a nominal aerodynamic table lookup model for determining the nondimensional pitching coefficient of 
an aircraft due to changes in elevator deflection as a function of angle-of-attack and elevator deflection assuming no 
failure, i.e.: 


Cm Se\ 9 = f{ a ’ Se ) ( 10 ) 

Eq. (10) represents a nonlinear table lookup function valid for the entire operating flight condition of the aircraft. 
However, if the elevator surface effectiveness is reduced by 25% updating this nonlinear function to adequately 
estimate the reduced surface effectiveness or any other type of failure is difficult and may not be possible. Also, the 
form, in general, is nonlinear requiring increased computational effort for computers. In our approach, an alternate 
form of the model was utilized to overcome these difficulties based on an increment to the nominal model: 

Cm Se \ f = Cm 3e | Q + A Cm Se |, A Se (11) 

In this model form the additional linear increment, A Cm Se \ x is identified for updating the model in the presence of 

the failure for flight Condition 1 . The new updated model should be valid within a neighboring vicinity of the flight 
condition used to update the model assuming the linear assumption holds true. However, this approach has two 
advantages: 1) the nominal nonlinear model information is not disregarded and used in developing a new updated 
model and; 2) the update is linear and more easily estimated using reduced computational effort. The identified 
increment is also used to estimate the flight envelop at a different condition (e.g., Condition 2) with no measurement 
data required for flight Condition 2. The increment found for Condition 1 is valid for Condition 2 since it is 
nondimensional. However, there are dynamic pressure difference effects between Condition 1 and Condition 2 that 
should be accounted. Therefore, the following linear update on the identified increment for predicting behavior at 
the new flight condition, i.e. Condition 2 can be utilized. 


A Cm 


Seh - - 2 ^ m 5e li 
#1 


( 12 ) 


where the new increment is scaled by the ratio of the trim dynamic pressures from flight Condition 1 to flight 
Condition 2. Other more sophisticated nonlinear extrapolation can certainly be applied to improve the prediction 
accuracy. For example, the basic form of the nominal curves (e.g. using polynomial) can be applied to the new 
model. However, it should be pointed out that the updated model has a higher accuracy in the vicinity of current and 
previously visited operating conditions and deviates from the true dynamics for an operating condition that differs 
significantly from what has been seen. Therefore, the whole flight envelope estimation process should be conducted 
as a progress process as illustrated in Figure 1. 

V. Flight Envelope Estimation 
A. Flight Envelope Estimation for Actuator Faults 

Compared with airframe faults, the actuator faults are much easier to model and estimate. As shown in Figure 3, 
the online flight envelope estimation for flight control actuator faults can be conducted in two steps: first, the FDIE 
module detects the fault and estimates the fault severity level; then the flight envelopes from the offline flight 
envelope library will be retrieved and interpolated to provide an accurate estimation of the flight envelope. This 
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approach has several advantages: 1) the flight envelopes for different fault scenarios in the offline flight envelope 
library can be made very accurate by conducting wind tunnel tests, thus accuracy is guaranteed as long as the online 
fault severity estimation is accurate; 2) the online flight envelope is generated by simply interpolating existing flight 
envelopes from the offline-generated flight envelope library, thus the approach is computationally efficient; 3) the 
implementation is straightforward. However, this interpolation approach can not easily be extended to cover 
airframe faults. It’s also worth noting that updated aircraft model with estimated actuator fault parameters can also 
be utilized by the reachability-based approach that is presented in the following section to calculate flight envelope 
updates. 



Figure 3. Online flight envelope estimation for actuator faults 


B. Flight Envelope Estimation Using Reachability Theory and Level Set Method 

Given dynamic system x = /(x,w), where xe R n ,ue Ue R m . Let denote the set of Lebesgue measurable 

functions from the interval [t 9 f] to U. Given the horizon T > 0 and a set of states Ke R n , the following viability 
and reachability problems can be formulated 6 : 

• Viability: Does there exist a u(-)e ^ t T] for which the trajectory *(■) satisfies x(-)e K for all te [0,7]? 

• Reachability: Does there exist a w(-)e %^ t r] and a tz [0,7] such that the trajectory satisfies x(f)e K ? 

With this problem formulation, the flight envelope estimation is to characterize the set of initial states for which 
the answer to the viability/reachability questions is “yes”, i.e. this set of initial states defines an envelope for the 
aircraft to be in if it intends to reach/remain in state set K in finite time. 

After the system model is updated by the system ID and/or fault detection/isolation estimators, reachability-based 
methods can be utilized to calculate flight envelope in a progressive way. A conservative choice of target set K not 
only helps to secure flight safety by applying conservative parameter limits, but also speeds up the reachable set 
calculation by restricting the optimization space. For example, when the aircraft detects a failure at a cruise speed of 
400 knots at the altitude of 20,000 feet, the set of initial states for calculating the reachable set can be set to the range 
of altitude in between 15,000 to 20,500 feet and airspeed in between 350 to 450 knots. The parameter limits 
calculated from the reachable set will be used by the envelope protection module to prevent exceedance of flight 
envelope while the aircraft controller brings the aircraft to approach landing conditions (if landing is an option). As 
the altitude of the aircraft decreases, new set of initial states can be set and the calculation of reachable set be 
repeated in a progressive fashion. 

VI. Intelligent Adaptive Flight Envelope Protection System 

This effort leverages the previous work carried out at Georgia Tech by a coauthor on reactionary envelope 
protection methodology 11,17 . The reactionary envelope protection method is similar in philosophy to obstacle 
avoidance. In obstacle avoidance, when an obstacle is detected in the path of a vehicle, a new safe trajectory is 
prescribed, and collision with the obstacle is avoided by following the safe trajectory. Similarly, the reactionary 
envelope protection method treats the limit boundary (upper or lower limit) as an ‘internal’ obstacle to the vehicle in 
its state space. This treatment allows the method to be applicable for both steady-state response critical as well as 
transient response critical limits. 
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The reactionary envelope protection method relies on predicting future envelope violations using finite-time 
horizon prediction of the limit parameter response, and hence, requires an accurate representation of the limit 
parameter dynamics over the prediction horizon. In the absence of the 
availability of an accurate model of the limit parameter dynamics, an 
approximate model augmented with adaptive neural nets is used. A 
single hidden layer neural network with sufficient number of neurons 
and appropriate interconnection weights can approximate a 
continuous function in a compact domain to a desired level of 
accuracy 18 . A block diagram representation of the adaptive estimation 
architecture is shown in Figure 4. As the linear model included in 
Figure 4 will be a poor global approximation of the limit parameter 
dynamics, it is augmented with an adaptive neural network block to 
obtain an improved local estimate of the limit parameter dynamics. 

Also, it includes an additional error feedback terms which improves 
model convergence. 

The adaptive estimate is used for predicting limit parameter response, and hence, any envelope violation in the 
future (over a selected horizon) to current control/command inputs. If a future violation is predicted, appropriate 
command/control corrections are then provided to enable the limit parameter response to effectively track a safe- 
limit-response profile. The safe-response-profile of the limit parameter is constructed (Figure 5) by assuming the 
existence of an imaginary circular obstacle and the direction of the safe-response-profile is chosen to be along the 
tangential path in avoiding collision with the imaginary obstacle. 




Figure 5: Safe-response-profile for envelope protection near limit boundary. 

The command/control corrections are computed based upon tracking the safe-response-profile. Using a model 
inversion approach, one such control/command correction is given by 



Figure 4. Adaptive Estimation of 
Limit Parameter Dynamics 
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where y 5 is safe-response profile, r is relative degree of the limit parameter response, — is estimate of control 

du 

sensitivity, y p is estimate of limit parameter, a i9 i = 0,1,2, are linear parameters of the approximate dynamics 

of limit parameters, v ad is output of the neural network compensating for model uncertainty, v dc is output of the 
linear dynamic compensator for stabilizing linearized error dynamics, Ji is normalized input vector of the neural 
network, and K is parameter of the linear dynamic compensator. 

VII. Simulation Results 

The NASA General Transport Model (GTM) 19,20,21 Matlab/Simulink simulation environment was utilized for 
initial proof-of-concept demonstration of the developed methods. The GTM is equipped with a micro-INS, which 
provided 3-axis linear accelerometer measurements, angular rate measurements, estimated attitude angles, and GPS 
velocity and position. Air data probes on each windtip measured angle of attack, sideslip angle, static pressure, and 
dynamic pressure. Measurements from static pressure sensors and ambient temperature sensors were used to 
compute air density and altitude. Engine speed in rpm was measured and used as input to an engine model to 
compute thrust. The engine model was identified from ground test data, with adjustments for ram drag identified 
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from flight data. Potentiometers on the rotation axes of all control surfaces measured control surface deflections. 
Mass properties were computed based on measured fuel flow, pre-flight weight and balance, and careful inertia 
measurements of the aircraft on the ground. The pilot stick and rudder commands and throttle position were also 
measured and recorded. Flight data was collected at 50 Hz. In the above formula, m is known for GTM. 
a x ,a zi T x ,T ,V, and a are measured or estimated by the Kalman filter. Therefore, in the software simulation 

environment, we assume the above measurements available. 

A. Online Flight Control Actuator FDIE on the GTM 

As a proof-of-concept demonstration, five fault isolation estimators were implemented for rudder, left and right 
ailerons, left and right elevators respectively on the GTM Simulink model. The inputs to the FDIE module are the 
actuator commands (from the output of the flight controller) and aircraft states (from onboard state estimator). The 
fault mode reported in this paper is control effectiveness loss. However, our simulation studied has shown that the 
approach worked with stuck actuator fault mode as well. The following FDIE logic is utilized. 

Fault detection decision scheme: The decision on the occurrence of a fault (detection) is made when at least one 
component of the residual generated by the FDE exceeds its corresponding adaptive threshold. 

Actuator fault isolation decision scheme: Adaptive thresholds for each FIE are designed, such that, in the event 
that a particular actuator fault occurs, all the components of the residual generated by the FIE using the correct fault 
functional structure will remain below their corresponding adaptive thresholds. The decision of the occurrence of a 
particular actuator fault (isolation) is made when at least one of the components of the residual generated by each of 
the remaining FIEs exceeds its corresponding adaptive threshold. 

Fault scenario 1: Left elevator 60% control effectiveness loss, fault time = 10s 

Proper control excitation is needed for the detection and isolation of actuator fault. For this simulation scenario, 
the actuator control signals and responding system states are shown in Figure 6. The residual signals from the fault 
detection estimator (FDE) and the adaptive thresholds are also shown in Figure 6. Clearly the second residual signal 
(for q - pitch rate) exceeded the threshold at time 10.4 seconds. The residual signals from the all FIEs are shown in 
Figure 7. It can be seen that all the residual signals (blue curves) from the left elevator FIE remained below the 
threshold signals (red curves) in Figure 7(b). The estimated fault parameter (control effectiveness coefficient) is 
shown in Figure 7(a). The estimated coefficient value is very close to the simulated value (0.4). The residual signals 
from other FIEs are shown in Figure 7 (c) to (f) respectively. It can be observed that at least one residual signal 
exceeded its corresponding threshold value. Therefore, the fault was also correctly isolated. 

Fault scenario 2: Right aileron 60% control effectiveness loss, fault time = 10s 

Similar actuator controls and flight condition were applied to this simulation scenario. To keep the paper brief, 
only the fault parameter estimation (Figure 8 right) and the residuals from the right aileron FIE (Figure 8 left) are 
shown. The fault parameter (control effectiveness coefficient) estimation is very close to the truth value (0.4). All 
the residual signals in Figure 8 (middle) remain below thresholds, while at least one residual signal exceeded its 
threshold in other FIEs. 

F ault scenario 3: Rudder 60% control effectiveness loss, fault time = 5s 

Similarly, simulation results for a rudder fault are shown in Figure 9. The results for left aileron and right 



Figure 6: Actuator commands, system states, residual signals and adaptive thresholds from the FDE 

(left: actuator commands from top: throttle, elevator, aileron, and rudder; middle: states from top: u, v, w, p, q, r; 
right plot: p/q/r residual signals (blue) and thresholds (red)) 
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Figure 7: Left elevator fault isolation and estimation results 
(a: estimate of left elevator control effectiveness coefficient; b-f: the outputs from all five FIEs where the residual 

signals are blue and adaptive thresholds are red.) 
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Figure 8: Right aileron fault isolation and estimation results 

(left: the outputs from the right aileron FIE where the residual signals are blue and adaptive thresholds are red; right: 

estimate of right aileron control effectiveness coefficient;) 
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Figure 9: Rudder fault isolation and estimation results 

(left: the outputs from the rudder FIE where the residual signals are blue and adaptive thresholds are red; right: 

estimate of rudder control effectiveness coefficient;) 
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B. Online System Identification and Reachability-based Flight Envelope Calculation 

A regularized recursive least square algorithm was utilized for online system identification of the changes of 
aerodynamic coefficients. As an improvement for fast detection and tracking in real-time, a change detection scheme 
and a time varying forgetting factor ahs been used. When a change in prediction residuals is detected, a smaller 
forgetting factor is utilized to discount ‘old’ data and place more weight on the latest measurements 16 . In this 
preliminary study, we assume the drag coefficient ( C D ) as a second-order polynomial function of angle of attack, i.e. 
Cd = Bq B2 cl . 

Some preliminary simulation results are shown in Figure 10. The aircraft is cruising at 130 ft/s at the altitude of 
8000 feet when an alpha doublet input was used as the excitation signal for system ID. Figure 10 (a) shows the angle 
of attack response; Figure 10 (b) shows the drag coefficient, C Di the identified Bo, B h B 2 , and the identification error, 
respectively. Figure 10 (c) depicts the C D curve as a nonlinear function of angle of attack as described by the above 
polynomial function. 



Figure 10: Online Identification of Aerodynamic Coefficients 


The aerodynamic envelope for GTM fast dynamics is then calculated using the reachability approach. In the 
simulation, the following GTM and environmental parameters are utilized: p = 0.0023769 Slugs/ft 3 ; S = 5.9018 ft 2 ; 
m = 1.5416 slugs; T min = 0; T^ 50 lbf (thrust). The baseline controller with angle of attack doublet as input is used 
for closed-loop GTM control. A Level Set Matlab Toolbox 7 was be used for the numerical solution of the partial 
differential equation required to solve the problem. The initial rectangular envelope is selected as 5CKV<250, - 
15°<y<25 0 , 0<h<1500, which are the initial bounds on airspeed, flight path angle and altitude. Figure 11 shows the 
flight envelope via reachable set calculation. Assuming the elevator surface gets stuck at 5 degree, Figure 12 shows 
the reduced flight envelope via the level set method. Comparing to Figure 11, the constraints on the responsiveness 
of elevator have resulted in noticeable reduction of the GTM achievable flight envelope. 



Figure 11: Calculated Flight Envelope for the Figure 12: Reduced Flight Envelope with Stuck 

nominal Case Elevator Actuators 

The general shape of the level sets suggests that certain states are unsafe and should be avoided. If the aircraft 
ever gets to such a state, then the aircraft will soon violate the flight envelope requirements, therefore appropriate 
control actions are required to keep the aircraft in the safe envelope. If the initial condition is inside the level set, 
unsafe states can be avoided by applying the optimal controls whenever the state trajectory hits the boundary of the 
level set, hence keeping the aircraft in the desired safety envelope. 
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C. Progressive Model Updating with Linear Extrapolation 

The extrapolation method presented in Section IV was applied to the updating of the Cm (pitching moment) 
coefficient in the presence of an elevator actuator fault. Figure 13 displays the time history overlay data from the 
updated model comparing with the response from a faulted system with a simulated 25% reduction in elevator 
effectiveness for two flight conditions. The changes of aerodynamic coefficient (in this case, the pitching 
coefficient) were identified at flight condition 1 (cruise flight). The linear extrapolation method (Eq. 12) was utilized 
to predict the changes at flight condition 2 (landing). The updated model demonstrated outstanding agreement 
indicating a good prediction in the flight envelop. Note that the estimates of the aerodynamic coefficients will be 
updated/corrected as the aircraft approaches that particular operating condition, thus the model is updated 
progressively. 



Figure 13: Performance of Updated Aerodynamic Model at Different Operating Conditions 

(solid green: faulty system; dashed blue: updated model. Note that the aerodynamic coefficient changes were 
identified at flight condition 1 and extrapolated to flight condition 2) 


D. Intelligent Adaptive Flight Envelope Protection 

Simulation results for several different operating conditions and maneuvering scenarios have been produced. A 
representative result is shown in Figure 14 for the purpose of illustration. 



(a) without envelope protection 




(b) Envelope protection with linear (c) envelope protection with NN- 
model enhanced model 


Figure 14: Automatic Envelope Protection for GTM Load Factor 

In this case, the aircraft was cruising at 90 knots. The simulated control input is an elevator pulse of -5 deg (to 
simulate a pull-up maneuver) at t=3 sec with a duration is 1 sec. A linearized model of load factor about the 
equilibrium point is used as an approximate model. The approximate model is corrected by including a linear 
correction term proportional to the difference between the true load factor value (measurement) and the estimated 
load factor value at each simulation step. The simulation is carried out at a fixed step size of 0.005 sec. The reactive 
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limit parameter prediction horizon is taken to be 10 times the simulation step size, i.e., 0.05 sec in the simulation 
results shown. Figure 14 (a) shows the simulation results without envelope protection. Assuming a limit of 2 g for 
load factor, the aircraft exceeded its load factor limit in this case. Figure 14 (b) shows the result of a linear model 
based envelope protection scheme, it managed to protect the aircraft against the limit, but the performance is 
compromised. Figure 14 (c) shows the result of a Neural Networks-enhanced envelope protection scheme, compared 
with the result in (b), the system not only protected the aircraft from exceeding load factor limit, but also pushed the 
performance to the allowed limitation. 


VTTI. Conclusion and Future Work 

This paper reports the first phase of the development of an onboard adaptive flight envelope estimation and 
protection system. Several enabling techniques including real-time system identification and health assessment, 
progressive model updating, reachability-based flight envelope estimation and Neural-Networks based adaptive 
envelope protection, were presented. Simulation studies using the NASA GTM model have successfully 
demonstrated the feasibility of the presented concept and architecture. 

Within the established architecture, future work will be focused on the following problems: 

(1) Sensor consistence check; because the approach heavily relies on the quality of the measurement sensor 
systems, a novel sensor consistency check method is needed to provide a high degree of sensor 
measurement confidence 22 . 

(2) Progressive model updating approach extended to cover all interested aerodynamic coefficients; 

(3) Rigorous study on airframe faults with a focus on asymmetric aircraft model accounting for changes in 
aerodynamics, mass properties, wing area and the center of gravity. 

(4) Expansion of the envelope protection algorithms to other limit parameters and the seamless integration of 
envelope estimation and protection modules. 
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